Skip to content

Commit 7f3c089

Browse files
stevespringettstevespringett
committed
Ported dependency and composition objects
Signed-off-by: Steve Springett <steve@springett.us>
1 parent 666b40d commit 7f3c089

File tree

3 files changed

+145
-5
lines changed

3 files changed

+145
-5
lines changed

‎schema/2.0/cyclonedx-2.0.schema.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,16 @@
5151
"components": {
5252
"$ref": "model/cyclonedx-component-2.0.schema.json#/$defs/components",
5353
"description": "A collection of components. When a metadata component is present, this array represents the inventory of components associated with that subject, forming a bill of materials. When the metadata component is omitted, the array provides component data for interchange purposes without establishing a compositional relationship."
54+
},
55+
"services": {
56+
"$ref": "model/cyclonedx-service-2.0.schema.json#/$defs/services"
57+
},
58+
"dependencies": {
59+
"$ref": "model/cyclonedx-dependency-2.0.schema.json#/$defs/dependencies"
60+
},
61+
"compositions": {
62+
"$ref": "model/cyclonedx-composition-2.0.schema.json#/$defs/compositions"
5463
}
64+
5565
}
5666
}

‎schema/2.0/model/cyclonedx-composition-2.0.schema.json‎

Lines changed: 91 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,98 @@
11
{
22
"$schema": "https://json-schema.org/draft/2020-12/schema",
3-
"$id": "http://localhost:8080/schema/2.0/cyclonedx-composition-2.0.schema.json",
3+
"$id": "https://cyclonedx.org/schema/2.0/model/cyclonedx-composition-2.0.schema.json",
44
"type": "null",
55
"title": "CycloneDX Transparency Expression Language: Composition",
6-
"$comment" : "CycloneDX JSON schema is published under the terms of the Apache License 2.0.",
6+
"$comment" : "OWASP CycloneDX is an Ecma International standard (ECMA-424) developed in collaboration between the OWASP Foundation and Ecma Technical Committee 54 (TC54). The standard is published under a royalty-free patent policy. This JSON schema is the reference implementation and is licensed under the Apache License 2.0.",
77
"$defs": {
8+
"compositions": {
9+
"type": "object",
10+
"title": "Compositions",
11+
"required": [
12+
"aggregate"
13+
],
14+
"additionalProperties": false,
15+
"properties": {
16+
"bom-ref": {
17+
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType",
18+
"title": "BOM Reference",
19+
"description": "An identifier which can be used to reference the composition elsewhere in the BOM. Every `bom-ref` must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links."
20+
},
21+
"aggregate": {
22+
"$ref": "#/$defs/aggregateType",
23+
"title": "Aggregate",
24+
"description": "Specifies an aggregate type that describes how complete a relationship is."
25+
},
26+
"assemblies": {
27+
"type": "array",
28+
"uniqueItems": true,
29+
"items": {
30+
"anyOf": [
31+
{
32+
"title": "Ref",
33+
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType"
34+
},
35+
{
36+
"title": "BOM-Link Element",
37+
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/bomLinkElementType"
38+
}
39+
]
40+
},
41+
"title": "BOM references",
42+
"description": "The bom-ref identifiers of the components or services being described. Assemblies refer to nested relationships whereby a constituent part may include other constituent parts. References do not cascade to child parts. References are explicit for the specified constituent part only."
43+
},
44+
"dependencies": {
45+
"type": "array",
46+
"uniqueItems": true,
47+
"items": {
48+
"type": "string"
49+
},
50+
"title": "BOM references",
51+
"description": "The bom-ref identifiers of the components or services being described. Dependencies refer to a relationship whereby an independent constituent part requires another independent constituent part. References do not cascade to transitive dependencies. References are explicit for the specified dependency only."
52+
},
53+
"vulnerabilities": {
54+
"type": "array",
55+
"uniqueItems": true,
56+
"items": {
57+
"type": "string"
58+
},
59+
"title": "BOM references",
60+
"description": "The bom-ref identifiers of the vulnerabilities being described."
61+
},
62+
"signature": {
63+
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/signature",
64+
"title": "Signature",
65+
"description": "Enveloped signature in [JSON Signature Format (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
66+
}
67+
}
68+
},
69+
"aggregateType": {
70+
"type": "string",
71+
"default": "not_specified",
72+
"enum": [
73+
"complete",
74+
"incomplete",
75+
"incomplete_first_party_only",
76+
"incomplete_first_party_proprietary_only",
77+
"incomplete_first_party_opensource_only",
78+
"incomplete_third_party_only",
79+
"incomplete_third_party_proprietary_only",
80+
"incomplete_third_party_opensource_only",
81+
"unknown",
82+
"not_specified"
83+
],
84+
"meta:enum": {
85+
"complete": "The relationship is complete. No further relationships including constituent components, services, or dependencies are known to exist.",
86+
"incomplete": "The relationship is incomplete. Additional relationships exist and may include constituent components, services, or dependencies.",
87+
"incomplete_first_party_only": "The relationship is incomplete. Only relationships for first-party components, services, or their dependencies are represented.",
88+
"incomplete_first_party_proprietary_only": "The relationship is incomplete. Only relationships for first-party components, services, or their dependencies are represented, limited specifically to those that are proprietary.",
89+
"incomplete_first_party_opensource_only": "The relationship is incomplete. Only relationships for first-party components, services, or their dependencies are represented, limited specifically to those that are opensource.",
90+
"incomplete_third_party_only": "The relationship is incomplete. Only relationships for third-party components, services, or their dependencies are represented.",
91+
"incomplete_third_party_proprietary_only": "The relationship is incomplete. Only relationships for third-party components, services, or their dependencies are represented, limited specifically to those that are proprietary.",
92+
"incomplete_third_party_opensource_only": "The relationship is incomplete. Only relationships for third-party components, services, or their dependencies are represented, limited specifically to those that are opensource.",
93+
"unknown": "The relationship may be complete or incomplete. This usually signifies a 'best-effort' to obtain constituent components, services, or dependencies but the completeness is inconclusive.",
94+
"not_specified": "The relationship completeness is not specified."
95+
}
96+
}
897
}
998
}

‎schema/2.0/model/cyclonedx-dependency-2.0.schema.json‎

Lines changed: 44 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,50 @@
11
{
22
"$schema": "https://json-schema.org/draft/2020-12/schema",
3-
"$id": "http://localhost:8080/schema/2.0/cyclonedx-dependency-2.0.schema.json",
3+
"$id": "https://cyclonedx.org/schema/2.0/model/cyclonedx-dependency-2.0.schema.json",
44
"type": "null",
5-
"title": "CycloneDX Transparency Expression Language: Dependency",
6-
"$comment" : "CycloneDX JSON schema is published under the terms of the Apache License 2.0.",
5+
"title": "CycloneDX Dependency Model",
6+
"$comment" : "OWASP CycloneDX is an Ecma International standard (ECMA-424) developed in collaboration between the OWASP Foundation and Ecma Technical Committee 54 (TC54). The standard is published under a royalty-free patent policy. This JSON schema is the reference implementation and is licensed under the Apache License 2.0.",
77
"$defs": {
8+
"dependencies": {
9+
"type": "array",
10+
"items": {"$ref": "#/$defs/dependency"},
11+
"uniqueItems": true,
12+
"title": "Dependencies",
13+
"description": "Provides the ability to document dependency relationships including provided & implemented components."
14+
},
15+
"dependency": {
16+
"type": "object",
17+
"title": "Dependency",
18+
"description": "Defines the direct dependencies of a component, service, or the components provided/implemented by a given component. Components or services that do not have their own dependencies must be declared as empty elements within the graph. Components or services that are not represented in the dependency graph may have unknown dependencies. It is recommended that implementations assume this to be opaque and not an indicator of an object being dependency-free. It is recommended to leverage compositions to indicate unknown dependency graphs.",
19+
"required": [
20+
"ref"
21+
],
22+
"additionalProperties": false,
23+
"properties": {
24+
"ref": {
25+
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType",
26+
"title": "Reference",
27+
"description": "References a component or service by its bom-ref attribute"
28+
},
29+
"dependsOn": {
30+
"type": "array",
31+
"uniqueItems": true,
32+
"items": {
33+
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType"
34+
},
35+
"title": "Depends On",
36+
"description": "The bom-ref identifiers of the components or services that are dependencies of this dependency object."
37+
},
38+
"provides": {
39+
"type": "array",
40+
"uniqueItems": true,
41+
"items": {
42+
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType"
43+
},
44+
"title": "Provides",
45+
"description": "The bom-ref identifiers of the components or services that define a given specification or standard, which are provided or implemented by this dependency object.\nFor example, a cryptographic library which implements a cryptographic algorithm. A component which implements another component does not imply that the implementation is in use."
46+
}
47+
}
48+
}
849
}
950
}

0 commit comments

Comments
 (0)